Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation OpenSSF has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packag...

[WP-M1] supplyTokenTo() may fail when Aave Pool address changed

Lines of code Vulnerability details function supplyTokenTouint256 depositAmount, address to external override nonReentrant uint256 shares = tokenToSharesdepositAmount; requireshares 0, "AaveV3YS/shares-gt-zero"; address underlyingAssetAddress = tokenAddress;...

Fedora: Security Advisory for dhcp (FEDORA-2022-05918f0838)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: dhcp-4.4.2-12.b1.fc34

DHCP Dynamic Host Configuration Protocol...

Fedora: Security Advisory for golang-k8s-kube-aggregator (FEDORA-2022-3a63897745)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-33436

NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as ...

Schneider Electric Uncontrolled Search Path Element in embedded Rockwell Automation ISaGRAF5 Runtime (CVE-2020-25182)

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft...

CVE-2022-29859

component/common/network/dhcp/dhcps.c in ambiot amb1sdk aka SDK for Ameba1 before 2022-03-11 mishandles data structures for DHCP packet data...

CVE-2022-29505

Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation...

PT-2022-19883 · Amb1 Sdk · Amb1 Sdk

Name of the Vulnerable Software and Affected Versions: amb1 sdk versions prior to 2022-03-11 Description: The issue is related to the mishandling of data structures for DHCP packet data in the dhcps.c file within the amb1 sdk. Recommendations: For versions prior to 2022-03-11, update to a version...

LINE for Windows 安全漏洞

LINE for Windows is a Windows-based instant messaging application from Japanese company LINE. A security vulnerability exists in LINE prior to version 7.8, which stems from a build error in the openssl dependency, making LINE for Windows prior to 7.8 vulnerable to DLL injection that could lead to...

The vulnerability of the kernel of the FireDTV driver in the Linux operating system allows a hacker to trigger an emergency shutdown of the system and compromise the confidentiality and integrity of the protected information.

The vulnerability of the FireDTV driver’s kernel in the Linux operating system arises due to an overflow in the buffer in the dynamic memory. Exploiting this vulnerability can allow an attacker to cause the system to crash and affect the confidentiality and integrity of the protected information...

ambiot amb1_sdk 安全漏洞

ambiot amb1sdk SDK for Ameba1 is an SDK for Ameba1 for ambiot individual developers. A security vulnerability exists in ambiot amb1sdk, which stems from component/common/network/dhcp/dhcps.c incorrectly handles data structures for DHCP packet data...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in buffer overflows in the stack, allowing attackers to execute arbitrary code.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code on the target system using a specially crafted file...

Lenovo PCManager 代码问题漏洞

Lenovo Lenovo Pcmanager Lenovo Computer Manager is a software from Lenovo, China that allows for comprehensive management of Pc devices. A security vulnerability exists in versions prior to Lenovo Pcmanager 4.0.40.2175, which stems from a DLL search path vulnerability in the application. An...

Apache Apisix Information Disclosure Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from overflowing buffers in the dynamic memory, allowing a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System IGSS, arises due to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code using specially created messages...

Samsung Telecom licensing issue vulnerability

Samsung Telecom is a communication feature for Samsung Samsung mobile devices. Samsung Telecom suffers from an authorization issue vulnerability that stems from a lack of proper privileges for dynamic receivers in Telecom, which could be exploited by an attacker to launch arbitrary activity...

CVE-2022-27527

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFTron earlier than 9.0.7 version in Autodesk Navisworks 2022, and 2020...

Autodesk Navisworks 缓冲区错误漏洞

Autodesk Navisworks is 3D model review software for architecture, engineering, and construction from Autodesk, Inc. A buffer error vulnerability exists in Autodesk Navisworks 9.0.7 in Autodesk Navisworks 2022, which stems from a memory corruption vulnerability that could lead to code execution vi...